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Primary Examiner — Zarni Maung 
Assistant Examiner — Andrew Caldwell 

[57] ABSTRACT 

A methodology and supporting structure for logging and 
ordering management events in a network management 
system in a managed environment is presented. The network 
system has a central broker, which monitors the managed 
environment and receives events in the managed 
environment, and an event store, which has non-textual files 
organized into sets with each set containing corresponding 
event log and event index files. Events are logged as 
received by the central broker into the non-textual files 
organized into the sets. A complete representation of one or 
more events is stored in a language-independent form in an 
event log file of the event store so that the event information 
may be read and formatted for presentation in a local 
language. An event index file of the event log contains the 
location of the one or more events. The flow from multiple 
streams of related events may also be tracked. 
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Nov 14, 2000 



DOCUMENT- IDENTIFIER: US 6148338 A 

TITLE: System for logging and enabling ordered retrieval of management events 



Brief Summary Paragraph Right (2) : 

The Simple Network Management Protocol (SNMP) and Common Management Information 
Protocol (CMIP) are network management protocols that provide a generic mechanism by 
which different manufacturers' equipment can be monitored and controlled from a 
management system, such as a UNIX server. A network component on a managed network 
can be monitored and controlled using a management protocol to communicate 
management information between network components on the network. A network 
component includes networked personal computers, workstations, servers, routers, and 
bridges. There exist several key areas of network management including fault 
management, configuration management, security management, performance management, 
and accounting management. With the ability to instruct a network component to 
report events and the ability to start processes on a network component, the network 
an be manipulated to suit changing conditions within a system. 
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[57] 



ABSTRACT 



A methodology for dynamically creating, modifying, and 
deleting nodal views of a managed network environment is 
presented. The methodology stores the group view informa- 
tion in a file that may be edited by a user. This allows the 
user to be able to dynamically configure group view infor- 
mation. The methodology also provides menubars, popup 
menus, and toolbar that are context sensitive to the group 
view that is selected. 
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DOCUMENT- IDENTIFIER: US 6054987 A 

TITLE: Method of dynamically creating nodal views of a managed network 



Brief Summary Paragraph Right (2) : 

The Simple Network Management Protocol (SNMP) and Common Management Information 
Protocol (CMIP) are network management protocols that provide a generic mechanism by 
which different manufacturers ' equipment can be monitored and controlled from a 
management system, such as a UNIX server. A network component on a managed network 
can be monitored and controlled using a management protocol to communicate 
management information between network components on the network. A network 
component includes networked personal computers, workstations, servers, routers, and 
bridges. There exist several key areas of network management including fault 
management, configuration management, security management, performance management, 
and accounting management. With the ability to instruct a network component to 
report events and the ability to start processes on a network component, the network 
can be manipulated to suit changing conditions within a system. 

Current US Cross Reference Classification (4) : 
709/223 

Current US Cross Reference Classification (5) : 
709/224 
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(73) Assignee: 3COM Corporation, Santa Clara, CA 
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(57) 



ABSTRACT 



A packet based high speed mesh forms a trunk cluster. The 
trunk cluster is constructed with a set of loosely coupled 
switches, a configuration protocol, trunked network 
interfaces, and optionally a reachablilty protocol. The trunk 
cluster provides a Logical LAN service. Each switch in the 
trunk cluster provides a single "shared LAN" by intercon- 
necting two or more links. The edge devices attached to the 
links run a trunk configuration protocol. These attached edge 
devices view the trunked ports as if trunked ports are 
connected to a shared LAN with multiple other attached 
devices. 

10 Claims, 4 Drawing Sheets 
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Feb 27, 2001 



DOCUMENT- IDENTIFIER: US 619534 9 Bl 
TITLE: Scalable logical LAN 



Brief Summary Paragraph Right (11) : 

As each trunk switch only carries part of the traffic between edge devices, each 
trunk switch does not need to and must not participate in any topology control or 
discovery protocol. Spanning tree, TCMP (Trunk Cluster Management Protocol) , IGMP 
(Internet Group Management Protocol) , and GARP (Generic Attribute Registration 
Protocol) packets are flooded. Unicast MAC (Media Access Controller) source 
addresses are learned and used to intelligently forward/filter unicast packets to 
minimize flooding within the "shared LAN" and increase throughput. The maximum 
throughput of the trunk cluster increases with each additional trunk switch. 
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[57] 



ABSTRACT 



The inventive system and method incorporates artificial 
intelligence concepts to create a system that automatically 
integrates new network elements. The system detects the 
connection of the new element with the system. The system 
identifies th e new element , either directly or inferentially, by 
examining t he protoco l, the inputs, and the outputs of the 
new element; as compared with stored informatio n. The 
inventive system then eithe r selects the appropriate rule set 
from previously written rules , modifies an existing rule s et 
from similar elements, or cr eates an appropriate rule seTto 
integrate each new element into tne network. The rule set 
produced by the system is then used to manage the new 
element. 

60 Claims, 1 Drawing Sheet 
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File: USPT 



Apr 4, 2000 



DOCUMENT- IDENTIFIER: US 6047279 A 

TITLE: System and method for automatic network management support using artificial 
intelligence 

Brief Summary Paragraph Right (10) : 

FIG. 1 depicts a schematic diagram of the prior NetExpert system 10. NetExpert is 
based on the Telecommunication Management Network (TMN) standards promulgated by the 
International Telecommunications Union. It supports the development and deployment 
of applications for the main TMN areas, i.e. fault, configuration, performance, 
accounting, and security. The NetExpert framework 10 has been designed to manage 
external systems that include network elements, network element management systems, 
legacy support systems, CMIP protocol controlled agents/managers, Simple Network 
Management Protocol ("SNMP") agents/managers, user applications, databases, and 
personnel. All of these elements 11 are objects that can be managed by the system, 
and the system can be used to provide functionality at each level of the TMN 
business model, element management, network management service management and 
business management levels . 

L14: Entry 11 of 14 File: USPT Apr 4, 2000 



DOCUMENT- IDENTIFIER: US 6047279 A 

TITLE: System and method for automatic network management support using artificial 
intelligence 

Brief Summary Paragraph Right (10) : 

FIG. 1 depicts a schematic diagram of the prior NetExpert system 10. NetExpert is 
based on the Telecommunication Management Network (TMN) standards promulgated by the 
International Telecommunications Union. It supports the development and deployment 
of applications for the main TMN areas, i.e. fault, configuration, performance, 
accounting, and security. The NetExpert framework 10 has been designed to manage 
external systems that include network elements, network element management systems, 
legacy support systems, CMIP protocol controlled agents/managers, Simple Network 
Management Protocol ("SNMP") agent s /managers , user applications, databases, and 
personnel. All of these elements 11 are objects that can be managed by the system, 
and the system can be used to provide functionality at each level of the TMN 
business model, element management, network management service management and 
business management levels. 
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Primary Examiner — Ajit Patel 
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[57] ABSTRACT 

Monitoring is done of communications which occur in a 
network of nodes, each communication being effected by a 
transmission of one or mor e packets among two or more 
communicating nodes, each communication complying with 
a jredefined communicatio n protocol s elected from among 
protocols available in the network. The contents of packets 
are detected passively and in real time, communication 
information associated wit h multiple protocols i s derived 
from the packet contents. 
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DOCUMENT- IDENTIFIER: US 6115393 A 
TITLE: Network monitoring 



Detailed Description Paragraph Right (33) : 

Among the major modules which make up Monitor 10 is a real time kernel 20, a 
boot/load module 22, a driver 24, a test module 26, an SNMP Agent 28, a Timer module 
30, a real time parser (RTP) 32, a Message Transport Module (MTM) 34, a statistics 
database (STATS) 36, an Event Manager (EM) 38, an Event Timing Module (ETM) 40 and a 
control module 42. Each of these will now be described in greater detail. 

Detailed Description Paragraph Right (49) : 

Event Manager (EM) 3 8 extracts statistics from STATS and formats it in ways that 
allow the Workstation to understand it. It also examines the various statistics to 
see if their behavior warrants a notification to the Management Workstation. If so, 
it uses the SNMP Agent software to initiate such notifications. 
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[57] ABSTRACT 

A client-server network management system includes: a 
plurality of managed computer network elements, a man- 
aged element server that executes on a first computer; and at 
least one managed element server client that typically 



executes on a second computer. The managed element server 
and managed element server client are computer processes 
that execute from memory of their respective computers. 
The client-server network management system is really two 
applications in one: a visual element manager builder and a 
manager. The manager provides the run-time environment in 
which element managers are executed to monitor and man- 
age computer network behavior such as network throughput, 
collision rate, and number of duplicate IP packets, to name 
a few. The manager portion of managed element server is 
independent of any graphic user interface. The logic and 
structure of the manager of managed element server is 
cleanly separated from the graphic user interfaces. The 
visual element manager builder is a visual development 
environment in which device vendors or network managers 
may create standardized element management applications, 
called element managers. A user can build an element 
manager without writing a any computer code. In addition, 
a user can edit an element manager without writing any 
computer code. A graphic user interface of this invention, 
that is displayed by the client, includes a visual image of a 
computer network element being managed. As a user looks 
at the visual display in the graphic user interface, the user is 
provided the same visual information as if the user where 
physically present at the location of the managed computer 
network element. Thus, at a glance, a user can obtain 
considerable information about the status of the computer 
network element as represented by the visual display. 
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Detailed Description Paragraph Right (209) : 

When the discovery process is complete, all discovered SNMP - enabled computer network 
elements are displayed in navigation tree 305. If managed element server 314 was 
able to associate a discovered computer network element with an element manager 
(EM) , navigation tree 3 05 has a node under managed elements with a node name with 
the format "<EM Name>@" . The managed element can be edited and monitored by server 
314 based on the definition of components. If no association can be made, the node 
name has the format "@" . In this embodiment, computer network elements located 
behind a firewall cannot be discovered. 
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(57) ABSTRACT 

A client-server network management system includes: a 
plurality of managed computer network elements, a man- 
aged element server that executes on a first computer; and at 
least one managed element server client that typically 
executes on a second computer. The managed element server 
and managed element server client are computer processes 
that execute from memory of their respective computers. 
The client-server network management system is really two 
applications in one: a visual element manager builder and a 
manager. The manager provides the run-time environment in 
which element managers are executed to monitor and man- 
age computer network behavior such as network throughput, 
collision rate, and number of duplicate IP packets, to name 
a few. The manager portion of managed element server is 
independent of any graphic user interface. The logic and 
structure of the manager of managed element server is 
cleanly separated from the graphic user interfaces. The 
visual element manager builder is a visual development 
environment in which device vendors or network managers 
may create standardized element management applications, 
called element managers. A user can build an element 
manager without writing a any computer code. In addition, 
a user can edit an element manager without writing any 
computer code. A graphic user interface of this invention, 
that is displayed by the client, includes a visual image of a 
computer network element being managed. As a user looks 
at the visual display in the graphic user interface, the user is 
provided the same visual information as if the user where 
physically present at the location of the managed computer 
network element. Thus, at a glance, a user can obtain 
considerable information about the status of the computer 
network element as represented by the visual display. 
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Detailed Description Paragraph Right (200) : 

When the discovery process is complete, all discovered SNMP - enabled computer network 
elements are displayed in navigation tree 305. If managed element server 314 was 
able to associate a discovered computer network element with an element manager 
( EM ) , navigation tree 3 05 has a node under managed elements with a node name with 
the format " <EM Name>@" . The managed element can be edited and monitored by server 
314 based on the definition of components. If no association can be made, the node 
name has the format "@" . In this embodiment, computer network elements located 
behind a firewall cannot be discovered. 
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An integrated multi-services access platform includes a time 
division multiplex interface coupled to a time division 
multiplex network, a matrix in communications with the 
time division multiplex interface, a frame relay groomer 
coupled to the matrix, an asynchronous transfer mode matrix 
coupled to the frame relay groomer, and an asynchronous 
transfer mode interface coupled to a frame relay/ 
asynchronous transfer mode network. The integrated multi- 
services access platform may further include an integrated 
elemen t ma nager, which includes a centralized management 
system coupled to a time division multiplex operational 
support system, a frame relay/asynchronous transfer mode 
network management system interworking unit coupled to at 
least one frame relay/asynchronous transfer mode network 
management system, an element management function unit 
operable for service provisioning, fault management, ele- 
ment and network monitoring, and metric measurements, an 
element management database having service and network 
configurations, status, and billing information, a simple 
network management protocol unit, and at least one appli- 
cation program interface coupled to at least one telecom- 
munications element, 

22 Claims, 6 Drawing Sheets 
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Detailed Description Paragraph Right (8) : 

Frame relay switch 120 includes a time division multiplex interface 122 coupled to 
an asynchronous transfer mode fabric 124 . A Simple Network Management Protocol 
(SNMP) agent 126 is coupled to both time division multiplex ports 122 and 
asynchronous transfer mode fabric 124. Asynchronous transfer mode fabric 124 
interfaces with frame relay and asynchronous transfer mode networks 132, and is 
operable to relay T3 and OC3 data traffic. An element manage r (EM) 128 controls and 
performs service provisioning for frame relay switch 120. Element manager 128 is 
coupled to frame relay and asynchronous transfer mode network management system 13 0 
Constructed and operating in this manner, multiple management systems are used and 
coordination between the management systems and the control and management of the 
time division multiplex and frame relay and asynchronous transfer mode networks is 
difficult and must be done manually. Because the management systems are not 
coordinated, with one managing the frame re lay/ asynchronous transfer mode logical 
plane and one managing the time division multiplex physical plane. Therefore, 
service provisioning is slow and cannot be automated. The result is high operation 
and support costs . 
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(57) 



ABSTRACT 



A method and apparatus provide for the automatic aggre- 
gation of network management information in spatial, tem- 
poral and functional forms. Management information relat- 
ing to a network is automatically aggregated by 
computational means in the form of a attribute name-value 
pair which is stored in an Aggregation Managed Object 
(AMO). The aggregation of network management informa- 
tion in the form of an AMO supports the spatial, temporal 
and functional aggregations. The AMOs themselves are 
stored in a database of a special management agent, the 
Management Aggregation and Visualization Server (MAVS) 
which allows network managers to access and set network 
information to and from the different aggregation forms, 

28 Claims, 6 Drawing Sheets 
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Brief Summary Paragraph Right (7) : 

The first generation of network management tools to face the challenge of the large 
numbers of network elements (scalability) , such as HP Openview, Sun Net Manager, IBM 
Netview, etc., follow closely the point-to-point management model. According to this 
model, a network management application (NM client) connects to a management agent 
(NM server) using one of the standard protocols for management such as SNMP or CMIP. 
The agent, contains information about a network element or a group of elements. A 
network manager retrieves or controls this information by issuing "get" and "set" 
operations. Especially in SNMP systems that do not support rich data tvx>e_ s , this 
exchange of management information is at a very low level. As a result, all the 
intelligence for providing more complex NM services resides within the client 
(manager) . First generation tools are therefore characterized by complex and 
expensive clients. Although these clients have the capability to maintain a 
hierarchical topology ma P am * thereby provide easier navigation through a possibly 
large network, the manager still has to employ a low level management protocol to 
interact with every network element. First generation systems offer few capabilities 
to customize the available management services b eyond the functionality offered by 
the' underlying NM protocol such as SNMP or CMIP, or the interface provided by a 
vendor supplied element management system . 
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(57) ABSTRACT 

In accordance with the invention, a method is provided for 
remotely managing a plurality of network element of a 
telecommunications network through a special communica- 
tion link including a computer internet such as a local area 
network, the world wide web or the Internet. A management 
computer is connected to an element management system 
server through a communication link including the computer 
internet. At least one of the plurality of network elements is 
also coupled to the element management server through the 
computer internet and the at least one of the plurality of 
network elements is managed via communications conveyed 
through the element management server between the man- 
agement computer and the at least one network element. 
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Detailed Description Paragraph Right (142) : 

The element management system interfaces to the AP via the SNMP Agent. A MIB is used 
to define the interface between the element management system Server and the Agent 
and is common to both the element management system Server and the Agent. The Agent 
is described here and the MIB is described in the following section. The Agent 
communicates with the element management system Server using the Internet standard 
Simple Network Management Protocol (SNMP) (see Internet document RFC- 1157) via a 
standard UDP/IP port. In this architecture, the intent is to use SNMPv2c, which 
provides enhanced capabilities over SNMPvl, such as the GETBULK operation. 

Detailed Description Paragraph Table (1) : 

APPENDIX A DEFINITION OF TERMS Alarm A condition, usually of an unexpected nature, 
which requires special and persistent technician notification. Active Alarm A JAVA 
applet displaying the current active alarms in List Browser the system for all 
managed objects. A sample Active Alarm List Browser Applet can be found Applet in 
Attachment 2 on the Alarms Web Page. ASN.l Abstract Syntax Notation One: A formal 
language used to define syntax. In the case of SNMP, ASN.l notation is used to 
define the format of SNMP protocol data units and of objects. AP Application 
Processor refers to a commercial computing system that provides generic computing 
facilities. APCC Application Processor Cluster Complex: the highly- available 
platform, or cluster computing environment, in which an AP in the cluster can run 
the application services of another AP in the cluster should that AP fail. AP EMS 
The OA&M software architecture components that reside Infrastructure on the AP to 
support the APCC OA&M architecture. These include the MIB on the AP, the SNMP agent 
on the AP, the event handler, and other components described in section 4 of this 
document. API Application Programming Interface: a well-defined software interface, 
usually abstracting the details of the underlying implementation from the client of 
the interface. Applet small Java program which is dynamically downloaded by a Web 
browser and executed by its virtual machine. Though a Java applet has access to many 
of the services provided by the browser execution environment (e.g. audio, network 
access), it is also restricted by the browser Security Manager (e.g. no access to 
local file system) . Attribute A property of a managed object. An attribute has a 
value. Attribute Code A code that identifies a specific attribute of a managed 
object class. Class Code An integer value which uniquely identifies a managed object 
class. Client A function passed by the client to the server that is used Callback by 
the server to deliver asynchronous notifications of Function attribute changes, 
configuration changes or event notifications. EMAPI Element Management Application 
Programming Interface Event Generally, an autonomous notification. We have defined 
four types of events that the AP can generate: alarms, reports, state changes, 
configuration changes. IS-634 An international standard suite that defines the 
interfaces required to attach base stations from one vendor to the MSC of another 
vendor. IDL Interface Definition Language: A C++-like notation for describing CORBA 
object interfaces. IDL is used to describe any resource or service a server 
component wants to expose to its clients without regard to its implementation 
language or operating system Inheritance The conceptual mechanism by which 
attributes, notifications, operations, and behavior are acquired by a subclass from 
its superclass. Instance An integer value that identifies a specific instance of a 
Identifier managed object and is unique within its managed object class. JAVA An 
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(57) ABSTRACT 

The client portion of a distributed client-server network 
management system uses an interface designed with, and 
written in, a platform independent language, such as Java. 
This allows management application programs to be written 
in the platform independent language and insures their 
portability. The inventive interface caches most of the man- 
agement information at the server so that only a small client 
program is necessary. This program can run on a system with 
minimal resources, thereby allowing a network manager to 
manage a network from virtually any location on the net- 
work. For example, the client management application could 
be written as a Java applet which could then be run on any 
Java-enabled browser. The inventive distributed manage- 
ment system can also connect with, and use, the services and 
structure of existing distributed network management sys- 
tems. 
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One such distributed network management tool is the Solstice Enterprise Manager. TM. 
(Solstice EM) network management system which was developed and is marketed by Sun 
Microsystems, Inc. This tool has an object-oriented and distributed architecture 
which consists of a plurality of cooperating components, including applications, 
libraries, information services, databases, and protocols, each of which performs 
specific tasks. The managed resources are arranged as a plurality of interconnected 
nodes and "management agents" running in each node gather information about the 
resources associated with the node. The information is then forwarded back to a 
management information server (MIS) which interacts with management applications 
running in other nodes. The MIS can request and change management parameter values, 
perform requested actions, and receive and evaluate problem reports (e.g. events, 
such as SNMP traps and CMIP notifications) that the management agents generate. 
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ABSTRACT 



Duplicates (duplicate managed objects) of managed objects 
that have been generated by a network element management 
system in order to manage the states of a plurality of network 
resources are produced and stored in a management infor- 
mation database of a network management system. Before 
transmitting a series of handling directives regarding a 
managed object generated by a network management 
request from a user terminal or service management system, 
to the network element management system, the network 
management system simulates the handling directives using 
the duplicate managed objects and notifies the source of the 
request of the results of simulated behavior. The network 
management system transmits the series of handling direc- 
tives to the network element management system when the 
simulated behavior ends normally but does do so when the 
simulated behavior ends abnormally. 
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Brief Summary Paragraph Right (3) : 

According to the prior art, such a network management system has a manager-agent 
architecture stipulated by the ISO and manages network elements or networks while 
transmitting handling directives to managed objects in the network element 
management system using a prescribed management protocol, e.g., a CM IP (Common 
Management Information Protocol ) . 

Detailed Description Paragraph Right (21) : 

Though network elements and the service management system are not illustrated in 
FIG. 1, the overall system has the network hierarchy shown in FIG. 8, the higher and 
lower layers have the manager- -agent relationships shown in FIG. 9, and the layers 
communicate via the communication protocol CMIP . More specifically, the network 
management system 21 and the network element management systems 11, 12 having a 
manager (M) --agent (A) relationship and management of the network elements is 
carried out by performing communication using the communication protocol CMIP . 
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